Worried that an office laptop could reach your control network? The industrial cybersecurity basics are simple: separate IT from OT, lock down remote access, keep logs, and rehearse your response.
This guide sits within our wider look at digital transformation in manufacturing.
| Item | Value |
|---|---|
| NIST OT security guide | SP 800-82 Rev. 3, published September 2023 |
| NIST guide purpose | Secure OT while respecting performance, reliability and safety requirements |
| Segmentation finding in CISA/USCG advisory AA25-212A | IT and OT environments not properly separated |
| Advisory remote-access recommendation | Multifactor authentication for all administrative and remote access |
| Advisory logging recommendation | Comprehensive, detailed logging across all systems |
Figures come from NIST’s SP 800-82 Rev. 3 page and CISA’s advisory AA25-212A. Publications get revised, so check the source before you rely on them.
Why plant cybersecurity differs from office IT
In an office, a security failure usually means lost data. On a plant floor it can mean a stopped line, damaged equipment or a safety event, so the priorities flip toward availability and safety.
NIST’s guide frames the task this way: it gives guidance on how to secure operational technology (OT) while addressing its “unique performance, reliability, and safety requirements”, as the NIST page for SP 800-82 Rev. 3 states in its September 2023 edition.
That has practical consequences:
- You cannot always reboot a controller to install a patch.
- Equipment such as PLCs, DCS and SCADA systems may run for many years with old software.
- Tools built for laptops, such as aggressive network scanners, can disturb fragile devices.
- Operators, maintenance staff and IT all own part of the risk.
Connectivity is also growing. Projects such as smart factory examples link machines to analytics and cloud services, which widens the paths an attacker could use.
Industrial cybersecurity basics: start with an asset inventory
You cannot protect what you cannot list. A basic inventory records every controller, HMI, engineering workstation, switch, and remote link, along with who owns it and what it talks to.
Keep it practical. A spreadsheet that is kept current beats a perfect tool nobody updates.
- Walk each line and cell and note every networked device.
- Record make, model, firmware version and location.
- Mark which devices can reach the office network or the internet.
- Name an owner for each group of devices.
- Review the list on a fixed schedule and after every project.
The same inventory feeds patch decisions, backup plans and incident response later on.
It also exposes surprises. Many plants discover forgotten modems, unmanaged switches or engineering laptops that were connected for a project and never removed. Finding them early is far cheaper than finding them during an incident, and it gives you a clear, shared picture to discuss with IT, operations and any outside integrators you rely on.
Separate IT from OT with segmentation
Segmentation means dividing the network into zones so that a problem in one place cannot freely spread. A public example shows why it matters.
In advisory AA25-212A, CISA and the US Coast Guard reported on a hunt at a critical infrastructure organization. According to the advisory, the OT environment was not properly configured, and a non-privileged user on the IT network could use their credentials to reach the critical SCADA VLAN.
The same advisory notes that attackers could use RDP or SSH to move laterally from compromised IT workstations to OT systems. A well-built boundary is meant to stop exactly that.
Good starting points for a boundary:
- Place a firewall between the office network and the plant network, with rules that allow only named, needed traffic.
- Use an intermediate zone, often called a DMZ, for servers that both sides must reach, such as historians.
- Split the plant network further by line or function where practical.
- Deny by default, then open only what the process needs.
Control remote access and accounts
Remote access is convenient for vendors and engineers, and it is a favourite route for attackers. Treat every remote path as a door that needs a lock and a log.
CISA’s advisory recommends enforcing multifactor authentication (MFA) for all administrative access, and for remote methods such as RDP and VPN connections, as set out in AA25-212A.
The same advisory flagged shared local admin credentials across many workstations. Shared passwords make one stolen credential a master key.
- Give each person their own named account.
- Use unique local admin passwords per machine and store them in a proper vault.
- Require approval and time limits for vendor sessions.
- Disable remote access paths you no longer use.
- Remove accounts quickly when people change roles or leave.
Log events, patch with care, and back up
Without logs you cannot tell what happened. The advisory says CISA could not hunt for every planned procedure partly because the organization’s event logging was insufficient, and it recommends comprehensive, detailed logging across workstations, servers, network devices and security appliances (AA25-212A).
Patching in OT needs planning rather than speed. Test updates where you can, schedule them for planned downtime, and where a patch is not possible, add compensating controls such as tighter segmentation.
Backups matter just as much. Keep offline copies of controller programs, configurations and HMI projects, and practise restoring them. A backup you have never restored is a hope, not a plan.
Prepare people and a response plan
Technology alone will not carry you. Staff need to know what a suspicious email, an unexpected USB stick or an odd HMI behaviour looks like, and who to call.
Write a short incident response plan that covers both IT and OT. It should say who decides to isolate a network segment, how to run the process safely in manual mode, and who talks to regulators, insurers and customers.
- Keep printed contact lists in case systems are down.
- Run a tabletop exercise with operations, maintenance, IT and management.
- Agree in advance which production steps can continue if the network is cut.
Security also touches production software. If you are choosing systems that sit between the shop floor and the office, read what is a manufacturing execution system to see where those connections tend to appear.
For a deeper framework, NIST’s SP 800-82 Rev. 3 is a free, detailed reference for securing OT. This site is independent and has no connection to NIST, CISA or any vendor named here.
Frequently asked questions
What are the industrial cybersecurity basics I should do first?
Show answer
Build an asset inventory, separate IT from OT, protect remote access with MFA, turn on logging, and write a response plan. CISA’s advisory AA25-212A recommends MFA and comprehensive logging, and it reported insufficient IT/OT segmentation.
Is OT security the same as IT security?
Show answer
No. Both protect systems, but OT puts safety, availability and reliability first, as NIST’s guide emphasises. That changes how you patch, scan and respond.
Do small plants need segmentation too?
Show answer
Yes. Even a modest plant can place a firewall between office and control networks. In advisory AA25-212A, CISA identified that the OT environment was not properly configured between IT and OT.
Where can I find official guidance?
Show answer
NIST publishes SP 800-82 Rev. 3 free of charge, and CISA publishes advisories and recommended practices for industrial control systems. Check each publisher for the latest versions.
